sectionorder:
- Connect
- Collect
commonfields:
  id: Hoxhunt v2
  version: -1
name: Hoxhunt v2
display: Hoxhunt v2
category: Email
provider: Hoxhunt
description: "Use the Hoxhunt integration to send feedback to reporters of incidents, set incident sensitivity, and apply SOC classification to incidents."
configuration:
- display: Server URL
  name: url
  type: 0
  required: true
  additionalinfo: e.g. https://api.hoxhunt.com/graphql-external
  defaultvalue: https://api.hoxhunt.com/graphql-external
  section: Connect
- display: API Key
  name: api_key
  type: 4
  required: true
  additionalinfo: Input your api key from Hoxhunt
  section: Connect
- display: Incident Mirroring Direction
  name: mirror_direction
  defaultvalue: Incoming And Outgoing
  type: 15
  required: false
  additionalinfo: "Choose the direction to mirror the incident: Incoming (from Hoxhunt to Cortex XSOAR), Outgoing (from Cortex XSOAR to Hoxhunt), or Incoming and Outgoing (from/to Cortex XSOAR and Hoxhunt)."
  options:
  - None
  - Incoming
  - Outgoing
  - Incoming And Outgoing
  hidden:
  - marketplacev2
  - platform
  section: Connect
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
  section: Connect
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
  section: Connect
- display: Fetch incidents
  name: isFetch
  type: 8
  required: false
  section: Collect
- display: Incidents Fetch Interval
  name: incidentFetchInterval
  type: 19
  required: false
  defaultvalue: "1"
  section: Collect
- display: Incident type
  name: incidentType
  type: 13
  required: false
  section: Collect
- display: First fetch timestamp
  name: first_fetch
  type: 0
  required: false
  additionalinfo: (<number> <time unit>, e.g., 12 hours, 7 days). Defaults to 7 days.
  defaultvalue: "7 days"
  section: Collect
- display: Fetch limit
  defaultvalue: "50"
  name: max_fetch
  type: 0
  required: false
  additionalinfo: Maxium number of incidents per fetch. Cap is 100.
  section: Collect
- display: Only fetch escalated incidents
  defaultvalue: "false"
  name: only_escalated_incidents
  type: 8
  required: false
  additionalinfo: "If enabled, only escalated incidents will be fetched. Set up escalation rules in Hoxhunt Response -> Incident Rules"
  section: Collect
- display: Only fetch open incidents
  defaultvalue: "true"
  name: only_open_incidents
  type: 8
  required: false
  additionalinfo: "If enabled, only open incidents will be fetched."
  section: Collect
script:
  script: ""
  type: python
  commands:
  - name: hoxhunt-current-user-get
    arguments: []
    outputs:
    - contextPath: HoxHunt.CurrentUser
      description: Current User information from Hoxhunt.
      type: string
    description: Gets the current user information from Hoxhunt.
  - name: hoxhunt-incident-threats-get
    arguments:
    - name: incident_id
      required: true
      description: The ID of the Hoxhunt incident the threats will be from.
    - name: sort
      description: Sorting strategy to use when returning threats from API. Defaults to createdAt_DESC. See Hoxhunt API documentation for more information.
      type: string
    - name: limit
      description: Limit the amount of threats returned. Defaults to 50, maximum is 100.
      type: number
    - name: filter
      description: Filter string to use to pick only threats of interest. See Hoxhunt API documentation for more information.
      type: string
    outputs:
    - contextPath: Hoxhunt.Threats
      description: Threats from Hoxhunt.
      type: string
    description: Gets threats from Hoxhunt.
  - name: hoxhunt-incident-note-add
    arguments:
    - name: incident_id
      required: true
      description: The ID of the Hoxhunt incident to which the note will be added.
    - name: note
      required: true
      description: The text content of the note to add to the Hoxhunt incident.
    outputs:
    - contextPath: Hoxhunt.addIncidentNode
      description: Add Incident note.
      type: string
    description: Add Incident note.
  - name: hoxhunt-incident-threats-remove
    arguments:
    - name: incident_id
      required: true
      description: The ID of the Hoxhunt incident from which threats will be removed.
    outputs:
    - contextPath: Hoxhunt.removeIncidentThreats
      description: Returns number of removed threats.
      type: number
    description: Remove all threats that belong to an incident.
    execution: true
  - name: hoxhunt-incident-soc-feedback-send
    arguments:
    - name: incident_id
      required: true
      description: The ID of the Hoxhunt incident for which SOC feedback will be sent.
      type: unknown
    - name: custom_message
      required: true
      description: A custom message to include with the SOC feedback.
      type: unknown
    - name: threat_feedback_reported_at_limit
      required: true
      description: Datetime limit. Accepts (<number> <time unit>), e.g "7 days", "one month" or a iso string (e.g. "2024-10-30T08:37:42.359Z").
      type: unknown
    outputs:
    - contextPath: Hoxhunt.sendIncidentSocFeedback
      description: The reporter will be informed the incident has been resolved and that no further actions are required from them.
      type: string
    description: Send feedback to reporters of incident about whether the reported email was safe, spam or malicious.
  - name: hoxhunt-incident-set-sensitive
    arguments:
    - name: incident_id
      required: true
      description: The ID of the Hoxhunt incident to be marked as sensitive or not sensitive.
      type: unknown
    - name: is_sensitive
      required: true
      auto: PREDEFINED
      predefined:
      - "TRUE"
      - "FALSE"
      description: True or False Boolean for whether the incident contains sensitive information.
      type: unknown
    outputs:
    - contextPath: Hoxhunt.setIncidentSensitive
      description: Incident sensitivity information.
      type: string
    description: Set incident to contain sensitive information.
  - name: hoxhunt-incident-set-soc-classification
    arguments:
    - name: incident_id
      required: true
      description: The ID of the Hoxhunt incident to classify.
    - name: classification
      required: true
      auto: PREDEFINED
      predefined:
      - MALICIOUS
      - SPAM
      - SAFE
      description: The SOC classification to apply to the incident.
    outputs:
    - contextPath: Hoxhunt.setIncidentSocClassification
      description: Incident SOC classification information.
      type: string
    description: Set soc classification for an incident.
  - name: hoxhunt-incident-update-state
    arguments:
    - name: incident_id
      required: true
      description: The ID of the Hoxhunt incident to update.
    - name: state
      required: true
      auto: PREDEFINED
      predefined:
      - OPEN
      - RESOLVED
      description: The new state of the incident.
    outputs:
    - contextPath: Hoxhunt.updateIncidentState
      description: Incident state information.
      type: string
    description: Updates Incident state.
  - description: Get mapping fields from remote incident. Please note that this method will not update the current incident. It's here for debugging purposes.
    name: get-mapping-fields
    arguments: []
    outputs: []
  dockerimage: demisto/python3:3.12.13.10116658
  isfetch: true
  runonce: false
  subtype: python3
  isremotesyncin: true
  isremotesyncout: true
  isFetchSamples: true
  ismappable: true
fromversion: 6.10.0
tests:
- Hoxhunt_test
defaultclassifier: Hoxhunt-classifier
defaultmapperin: Hoxhunt-mapper-incoming
defaultmapperout: Hoxhunt-mapper-outgoing